MSHTML Zero-Day in Windows Exploited by APT28 Prior to Feb 2026 Security Update

Microsoft released its Patch Tuesday updates, addressing 59 vulnerabilities, including a critical zero-day flaw in the Windows MSHTML framework.

Tracked as CVE-2026-21513, this actively exploited vulnerability allows attackers to bypass security features and execute arbitrary code.

APT28 is a well-documented advanced persistent threat group known for sophisticated malware campaigns.

Security researchers from Akamai discovered that the Russian state-sponsored threat group, APT28, was exploiting this flaw in the wild before the official patch was available.

Vulnerability Overview

Feature	Details
CVE ID	CVE-2026-21513
CVSS Score	8.8 (High)
Vulnerability Type	Security Feature Bypass
Affected Component	MSHTML Framework (ieframe.dll)
Threat Actor	APT28 (Russian State-Sponsored)
Exploitation Status	Actively Exploited In-the-Wild

The vulnerability originates in the ieframe.dll component, which manages hyperlink navigation for Internet Explorer.

The code lacked proper validation for target URLs. Because of this weak validation, attackers could send malicious inputs to specific code paths that trigger the ShellExecuteExW function.

This flaw allows threat actors to break out of the browser’s secure sandbox environment and execute arbitrary local or remote files on the victim’s machine without warning.

Researchers first spotted the APT28 exploit in late January 2026. The threat actors used a specially crafted Windows Shortcut file (.lnk) that contained a hidden HTML payload at the end of its structure.

When opened, the payload connects to an attacker-controlled domain (wellnesscaremed[.]com) to retrieve multistage malware.

To ensure successful execution, the exploit leverages nested iframes and multiple Document Object Model (DOM) contexts.

This technique allows attackers to bypass major Windows security defenses, specifically Mark of the Web (MotW) and Internet Explorer Enhanced Security Configuration (IE ESC).

By downgrading the security context, the malicious script forces the system to execute the dangerous ShellExecuteExW call.

While the observed campaign relies on malicious .lnk files, experts warn that any application embedding the MSHTML component could trigger this vulnerable code path.

This means other delivery methods beyond traditional phishing are highly likely.

To address CVE-2026-21513, Microsoft implemented stricter hyperlink protocol validation in the February 2026 security patch update.

The fix ensures that standard protocols, such as HTTP, HTTPS, and FILE, are strictly contained and executed within the secure browser environment.

They can no longer be passed directly to the ShellExecuteExW function, effectively neutralizing the exploit chain.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.